APT killing chain reconstruction and prediction method and system based on causal reasoning

Abstract

The invention relates to the technical field of APT killing chain reconstruction and prediction methods, and provides an APT killing chain reconstruction and prediction method and system based on causal reasoning. The method aims at solving the problems that in an existing APT detection and defense technology, multi-source heterogeneous data integration is difficult, space-time dynamic feature modeling is insufficient, killer chain reconstruction is inaccurate, the predictive capacity is limited, interpretability is poor, and real-time performance and accuracy are difficult to consider at the same time. The method comprises the steps of obtaining multi-source heterogeneous data, constructing a causal graph, performing multi-modal feature extraction based on the causal graph, and obtaining node initial feature representation; inputting the node initial feature representation into a time sequence causal graph convolution learning algorithm to obtain an optimized node representation; executing killer chain reconstruction based on the optimized node representation to obtain a possible killer chain sequence; predicting a future attack path according to the possible killing chain sequence to obtain a potential attack path; and generating an interpretability analysis report based on the potential attack path.

Description

Technical Field

[0001] The present invention relates to the technical field of APT kill chain reconstruction and prediction methods, and in particular to an APT kill chain reconstruction and prediction method and system based on causal reasoning. Background Art

[0002] Advanced Persistent Threat (APT), as a complex, long-term and highly targeted cyber attack, has become one of the most severe challenges in the current cybersecurity field. With the rapid development of information technology and the deepening of digital transformation, the frequency and complexity of APT attacks are constantly increasing, especially in high-value targets such as finance, government and critical infrastructure.

[0003] Existing APT detection and defense technologies can be mainly divided into the following categories:

[0004] 1. Rule-based detection system: This is the most traditional approach, identifying potential threats through predefined rule sets. For example, open source intrusion detection systems such as Snort and Suricata belong to this category. However, this approach faces serious limitations:

[0005] a) It is difficult to deal with unknown attack patterns;

[0006] b) The cost of rule maintenance is high and updates are not timely;

[0007] c) Easily circumvented by attackers;

[0008] d) The false positive rate is high, which places a huge burden on security analysts.

[0009] 2. Anomaly detection based on machine learning: In recent years, researchers have begun to try to use machine learning techniques to detect network anomalies. For example, clustering algorithms or anomaly detection algorithms such as IsolationForest are used to identify abnormal traffic. This type of method is an improvement over rule-based methods, but still has the following problems:

[0010] a) It is difficult to capture the timing and causal relationship of attacks;

[0011] b) Sensitive to changes in normal behavior and prone to false alarms;

[0012] c) Lack of understanding and ability to reconstruct the overall kill chain.

[0013] 3. Deep learning methods: With the development of deep learning technology, some studies have begun to apply convolutional neural networks (CNNs) and recurrent neural networks (RNNs) to APT detection. For example, some studies use LSTM networks to perform sequence analysis on network traffic. These methods have made breakthroughs in processing high-dimensional data and capturing long-term dependencies, but there are still some key issues:

[0014] a) It is difficult to effectively integrate multi-source heterogeneous data;

[0015] b) Lack of consideration of network topology;

[0016] c) The model has poor interpretability and is difficult to be trusted and adopted by security experts;

[0017] d) The computational complexity is high and it is difficult to meet the needs of real-time detection.

[0018] 4. Graph Neural Network Methods: Recently, graph neural networks (GNNs) have attracted attention due to their ability to naturally process network structure data. Some studies have tried to use graph convolutional networks (GCNs) to analyze network security incidents. However, these methods still have the following shortcomings:

[0019] a) It is difficult to effectively handle dynamically changing network structures;

[0020] b) Limited ability to model long-term kill chains;

[0021] c) Lack of explicit modeling of causal relationships affects the understanding of attack intent;

[0022] d) It is difficult to accurately predict future attack paths.

[0023] In summary, existing technologies face the following major technical problems when dealing with APT attacks:

[0024] 1. It is difficult to effectively integrate and utilize multi-source heterogeneous data;

[0025] 2. Lack of comprehensive modeling of the spatiotemporal dynamic evolution of attacks;

[0026] 3. Unable to accurately reconstruct the complete kill chain;

[0027] 4. Limited predictive capabilities, making it difficult to support active defense;

[0028] 5. Poor interpretability and difficult to combine with human expert knowledge;

[0029] 6. It is difficult to achieve both real-time and accuracy, especially in large-scale network environments.

[0030] These problems seriously restrict the effectiveness of existing APT defense systems, leaving many high-value targets facing huge security risks. Therefore, developing new APT detection and defense methods that can comprehensively solve these problems has important theoretical significance and practical application value. Summary of the invention

[0031] The APT kill chain reconstruction and prediction method based on causal reasoning proposed in this paper is designed to address the above technical problems. This method combines the latest deep learning, graph learning and causal reasoning technologies, and proposes an innovative quantum-inspired spatiotemporal causal attention graph convolutional network (QISCA-GCN) algorithm, which achieves efficient detection, precise reconstruction and accurate prediction of APT attacks.

[0032] The present invention provides an APT kill chain reconstruction and prediction method based on causal reasoning, comprising the following steps:

[0033] Acquire multi-source heterogeneous data, and perform data preprocessing and causal graph construction based on the multi-source heterogeneous data to obtain an initial causal graph;

[0034] Performing multimodal feature extraction based on the initial causal graph to obtain initial feature representation of nodes;

[0035] Inputting the initial feature representation of the node into a temporal causal graph convolutional learning algorithm to obtain an optimized node representation;

[0036] Performing kill chain reconstruction based on the optimized node representation to obtain a possible kill chain sequence;

[0037] Predicting future attack paths based on the possible kill chain sequence to obtain potential attack paths;

[0038] Generate an explainability analysis report based on the potential attack path; and perform model updating and optimization according to the explainability analysis report to optimize the initial causal graph, and return to perform data preprocessing and causal graph construction steps to form a closed-loop iteration.

[0039] Specifically, the temporal causal graph convolution learning algorithm is a quantum-inspired spatiotemporal causal attention graph convolution network, comprising the following steps:

[0040] (a) Initialize the node quantum state vector |ψ i >

[0041] (b) Perform T iterations:

[0042] (b1) Based on the node quantum state vector |ψ i > Calculate quantum measurements to get node characteristics h I ; (b2) according to the node feature hi Update the edge weight W ij ;

[0043] (b3) Calculate the multi-scale attention a based on the edge weight W ij ; ij ;

[0044] (b4) Update the node representation h using the multi-scale attention a ij ; i ;

[0045] (b5) Update the quantum state |ψ based on the updated node representation h′ i >; i >;

[0046] (c) Output the final node representation h I ; where, |ψ i > represents the quantum state of node v i , h i represents the feature representation of node v i , w ij represents the edge weight between node v i and v j , a ij represents the attention weight of node v i to v j , and T represents the number of iterations.

[0047] Specifically, the quantum measurement process in step (b1) is as follows:

[0048]

[0049] where, M = ∑ k λ k |k><k| is the quantum measurement operator, λ k is a learnable parameter, p ij is the probability distribution of node v i in the j-th modality, <j|k> is the inner product, and is obtained as follows:

[0050] <j|k> = softmax(q T ·tanh(W·[x ij ||x ik +b))

[0051] where, q, W, b are learnable parameters, x i j and x ik are the features of node v i in the j-th and k-th modalities respectively.

[0052] Specifically, the edge weight update process in step (b2) is as follows:

[0053]

[0054] w ij =g ij ·w ij +(1-g ij )·F(w ij )

[0055] Among them, g ij is the update gate, σ is the sigmoid function, W g and b g is a learnable parameter, Δt ij is the time interval, Δs ij is the spatial distance, D is the learnable fractal dimension, F(x) is the chaotic mapping function, defined as F(x) = rx(1-x), and r is a learnable parameter.

[0056] Specifically, the multi-scale attention calculation process in step (b3) is as follows:

[0057]

[0058] a ij =softmax(∑ l α l ·K l (i, j))

[0059] Among them, K l (i, j) is the multi-scale causal kernel, σ l is the kernel width of the lth scale, m ij is a mask based on causal structure, α l is the learnable scale weight.

[0060] Specifically, the node representation update process in step (b4) is as follows:

[0061]

[0062] Among them, W and b are learnable parameters, and R(x) is the residual function, which is defined as:

[0063] R(x)=W r ·x+b r , W r and b r are learnable parameters.

[0064] Specifically, the kill chain reconstruction step includes:

[0065] Using an improved Kahn algorithm to topologically sort the optimized node representations to obtain a preliminary attack sequence;

[0066] Applying a beam search algorithm based on the preliminary attack sequence to obtain multiple candidate kill chains;

[0067] The multiple candidate kill chains are evaluated using a conditional random field model to obtain a final kill chain and its confidence level.

[0068] Specifically, the future attack path prediction step includes:

[0069] Based on the possible kill chain sequence, the state representation is generated using the LSTM encoder with attention mechanism;

[0070] Based on the state representation, define a hierarchical softmax action space;

[0071] Based on the action space, a Monte Carlo tree search algorithm is applied to perform path prediction to obtain potential attack paths.

[0072] Specifically, the model updating and optimization steps include:

[0073] Perform incremental learning based on the sliding window strategy to update model parameters;

[0074] Update the causal structure using the improved PC algorithm;

[0075] Apply Bayesian optimization algorithm for hyperparameter optimization;

[0076] Model compression is performed through knowledge distillation technology to obtain an optimized lightweight model.

[0077] APT kill chain reconstruction and prediction system based on causal reasoning, including:

[0078] Data preprocessing and causal graph construction module, used to obtain multi-source heterogeneous data and perform data preprocessing and causal graph construction;

[0079] A multimodal feature extraction module, used for performing multimodal feature extraction based on the output of the data preprocessing and causal graph construction module;

[0080] A temporal causal graph convolutional learning module, used for applying a temporal causal graph convolutional learning algorithm to the output of the multimodal feature extraction module;

[0081] A kill chain reconstruction module, configured to perform kill chain reconstruction based on the output of the temporal causal graph convolutional learning module;

[0082] A future attack path prediction module, used to predict the future attack path according to the output of the kill chain reconstruction module;

[0083] an explainability analysis module, configured to generate an explainability analysis based on the output of the future attack path prediction module; and

[0084] The model updating and optimization module is used to perform model updating and optimization according to the output of the interpretability analysis module, and feed back the optimization result to the data preprocessing and causal graph construction module.

[0085] The beneficial effects of the present invention are mainly reflected in the following aspects:

[0086] 1. Highly integrated multi-source heterogeneous data: Through the multimodal feature extraction step, multiple data sources such as network logs, system events and user behaviors are effectively integrated to improve the ability to identify complex attack behaviors.

[0087] 2. Accurately modeling spatiotemporal dynamic features: The QISCA-GCN algorithm innovatively combines quantum computing ideas and graph neural networks, which can effectively capture the spatiotemporal dynamic evolution process of network attacks and greatly improve the modeling capabilities of long-term and complex APT attacks.

[0088] 3. Accurately reconstruct the kill chain: Through the combination of causal reasoning and graph structure learning, the system can more comprehensively capture each stage of the attack and achieve high-precision reconstruction of the complete kill chain.

[0089] 4. Powerful predictive capabilities: Based on the reconstructed kill chain and learned attack patterns, the system can accurately predict possible future attack paths, providing strong support for active defense.

[0090] 5. High interpretability: Through local and global interpretability analysis, the system can provide security analysts with clear decision-making basis and promote human-machine collaboration.

[0091] 6. Superior real-time performance: Thanks to optimized algorithm design and high-performance hardware support, the system can achieve fast response in a large-scale network environment, and the average response time is significantly better than existing methods.

[0092] 7. Low false alarm rate: The method of integrating causal reasoning and deep learning effectively reduces false alarms and improves the practicality and reliability of the system.

[0093] 8. Adaptive learning capability: Through continuous model updates and optimization, the system can continuously adapt to new attack patterns and changes in the network environment to maintain long-term effectiveness.

[0094] 9. Support active defense: Predictive analysis capabilities provide security teams with the possibility of active defense, shifting from passive response to active prevention.

[0095] 10. Universal applicability: Although the system performs well in protecting high-value targets such as financial institutions, its design principles make it equally applicable to network environments of various sizes and types.

[0096] In summary, the present invention provides a comprehensive, efficient and explainable APT attack defense solution, significantly improving the detection, analysis and prevention capabilities of complex network threats, and bringing revolutionary progress to the field of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] Figure 1 This is a flow chart of the APT kill chain reconstruction and prediction method based on causal reasoning of the present invention.

[0098] Figure 2 This is a flow chart of the temporal causal graph convolution learning steps of the present invention.

[0099] Figure 3 This is a schematic diagram of the APT kill chain reconstruction and prediction system framework based on causal reasoning of the present invention. DETAILED DESCRIPTION

[0100] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation methods, structures, features and effects thereof are described in detail below in conjunction with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0101] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0102] The present invention provides a method and system for reconstructing and predicting an APT kill chain based on causal reasoning, which is particularly suitable for large-scale enterprise network security defense scenarios. In this scenario, enterprises face complex and changeable network threats, especially advanced persistent threats (APTs). These APT attacks are usually long-lasting and highly concealed, posing a huge challenge to traditional security defense measures. The present invention aims to provide a method and system that can effectively reconstruct the kill chain and predict future attack paths through the combination of deep learning and causal reasoning.

[0103] The technical solution of the present invention is clearly and completely described below in conjunction with specific implementation methods.

[0104] Please refer to Figure 1 ,The APT kill chain reconstruction and prediction method based on causal reasoning includes the following steps:

[0105] 1. Data preprocessing and causal graph construction step. In this step, the system first obtains multi-source heterogeneous data, including but not limited to network logs, system events, and user behavior data. For example, a large financial institution uses Zeek network security monitor to collect communication data at each layer of the TCP / IP protocol stack, collects system-level events through Windows event logs and Linux syslog, and uses a custom user behavior monitoring agent to record employee keyboard input and mouse clicks.

[0106] Data preprocessing includes the following sub-steps:

[0107] a) Remove duplicate records: Use MD5 hash to generate a unique identifier for each record and remove duplicates.

[0108] b) Outlier processing: The IsolationForest algorithm is used to detect and mark outliers. The key parameters of the algorithm include the sample size (usually set to 256) and the contamination factor (usually set to 0.1).

[0109] c) Missing value filling: For time series data, use the forward filling method; for categorical data, use the mode filling method.

[0110] The process of constructing a causal graph is as follows:

[0111] a) Node definition: Each event is a node, and its attributes include {event ID, timestamp, event type, source IP, destination IP, port, protocol}.

[0112] b) Edge definition: If two events meet one of the following conditions, a directed edge is added:

[0113] 1) Adjacent in time (time interval is less than 5 minutes) and have the same IP address;

[0114] 2) Comply with predefined attack pattern rules (such as a port scan followed by a vulnerability exploit attempt);

[0115] c) Use the Peter-Clark algorithm (PC algorithm) to preliminarily estimate the causal structure. The key parameters of the PC algorithm include the significance level (usually set to 0.05) and the maximum condition set size (usually set to 3).

[0116] 2. Multimodal feature extraction step, based on the initial causal graph, this step extracts features from different types of data:

[0117] a) Text data processing: Use the BERT-base-uncased model (768-dimensional output) to extract text features. For texts longer than 512 tokens, a segmentation processing + average pooling strategy is used.

[0118] b) Numerical data processing: Design a 5-layer stacked denoising autoencoder (SDAE) with a structure of

[0119] [input_dim, 256, 128, 64, 32]. Use the mean squared error (MSE) as the reconstruction loss and train it with the Adam optimizer. Set the learning rate to 0.001 and the batch size to 64.

[0120] c) Temporal data processing: Design a bidirectional LSTM network with a hidden layer size of 128 and a 2-layer structure. Use the hidden state of the last time step as the feature representation.

[0121] d) Feature fusion: Map the features of each modality to the same dimension (256 dimensions) through a fully connected layer. Use the attention mechanism for weighted summation:

[0122] F = ∑(α i ·FC i (f i ))

[0123] where α i is the attention weight, FC i is the fully connected layer, and f i are the features of each modality.

[0124] 3. Please refer to Figure 2 , the learning steps of the temporal causal graph convolution. In this step, apply the quantum-inspired spatio-temporal causal attention graph convolution network (QISCA-GCN) algorithm, including the following sub-steps:

[0125] a) Initialize the node quantum state vector |ψ i >:

[0126]

[0127] where p ij is the probability distribution of node v i on the j-th modality, and |j> is the basis vector.

[0128] b) Perform T iterations (usually T is set to 10):

[0129] b1) Quantum measurement process:

[0130]

[0131] where, M = ∑ k λ k |k><k| is the quantum measurement operator, and λ k is the learnable parameter.

[0132] <j|k> =softmax(q T ·tanh(W·[x ij ||x ik ]+b))

[0133] q, W, b are learnable parameters, x i j and x ik For node v i The features of the j-th and k-th modes.

[0134] b2) Edge weight update:

[0135]

[0136] w ij =g ij ·w ij +(1-g ij )·F(w ij )

[0137] Among them, g ij is the update gate, σ is the sigmoid function, W g and b g is a learnable parameter, Δt ij is the time interval, Δs ij is the spatial distance (such as the Hamming distance of IP addresses), D is the learnable fractal dimension (the initial value is set to 1.5), F(x) is the Logistic mapping function: F(x) = rx(1-x), r is a learnable parameter (the initial value is set to 3.8).

[0138] b3) Multi-scale attention calculation:

[0139]

[0140] a ij =softmax(Σ l α l ·K l (i, j))

[0141] Among them, K l (i, j) is the multi-scale causal kernel, σ l is the kernel width of the lth scale (usually using [0.1, 1, 10] three scales), m ij is a mask based on causal structure, α l is the learnable scale weight.

[0142] b4) Node representation update:

[0143] h′ i =∑ j aij ·(W·h j +b)+R(h i )

[0144] Among them, W and b are learnable parameters, and R(x) is the residual function, defined as R(x) = W r ·x+b r , W r and b r are learnable parameters.

[0145] b5) Update the quantum state:

[0146] |ψ i > = N(h′ i ), where N is the normalization function.

[0147] c) Output the final node representation h i .

[0148] The quantum-inspired spatiotemporal causal attention graph convolutional network (QISCA-GCN) is the core innovation of this invention and solves multiple technical problems. First, in terms of multi-source heterogeneous data integration, QISCA-GCN uses quantum state representation |ψ i > Fusion of multimodal information, using quantum measurement process h i =<ψ i |M|ψ i > Achieve unified representation of heterogeneous data, thereby significantly improving the ability to identify complex attack behaviors and reducing the complexity of data preprocessing. Secondly, in terms of spatiotemporal dynamic feature modeling, by introducing the edge weight update mechanism g ij and the multi-scale causal kernel K l (i, j), combined with the time interval Δt ij and spatial distance Δs ij , accurately modeling the spatiotemporal dynamic characteristics of APT attacks, improving the detection capability of long-term and complex attacks. In addition, through the multi-scale attention mechanism ij =softmax(∑α l ·K l (i, j)), QISCA-GCN effectively captures long-range dependencies and significantly improves the ability to understand and reconstruct complex attack chains spanning a long period of time. Its quantum measurement process and attention mechanism enhance the visualization and explanation of model decisions and improve credibility. At the same time, the quantum-inspired algorithm design provides the possibility of parallel computing, and the iterative update mechanism improves computing efficiency and is suitable for large-scale network environments. Dynamic edge weight update w ij =g ij ·w ij +(1-g ij )·F(w ij) enhances the model's ability to adapt to changes in the network environment and improves its long-term effectiveness. The QISCA-GCN algorithm effectively solves multiple key technical problems in APT attack detection by innovatively combining quantum computing ideas, graph neural networks, and causal reasoning. It not only improves detection accuracy and comprehensiveness, but also enhances the interpretability and adaptability of the model, providing a new paradigm for APT attack defense and has the potential to significantly improve the overall level of network security protection.

[0149] 4. Kill chain reconstruction step. Based on the optimized node representation, this step performs kill chain reconstruction:

[0150] a) Use the improved Kahn algorithm for topological sorting: Define node priority: P(v i )=∑ j w ij ·I(v j )where I(v j ) is the node v j The importance score of a page is calculated using the PageRank algorithm.

[0151] The improved Kahn algorithm is designed to take into account edge weights and node importance to better meet the needs of APT attack chain reconstruction. Its implementation logic includes the following steps: First, during the initialization process, an empty queue Q is created to store nodes with an in-degree of 0, and an empty list L is created to store the final topological sorting results, and the initial in-degree and importance score I(v) of each node is calculated (such as using the PageRank algorithm). Next, the priority P(v) of each node v is calculated, and the formula is:

[0152] P(v)=∑(w uv I(u))

[0153] Where u is all the incoming edge nodes of v, and w_uv is the weight of the edge (u, v). Then, all nodes with in-degree 0 are added to the queue Q and sorted in descending order by P(v). In the main loop, when Q is not empty, take out the node n with the highest priority from Q and add n to the result list L. For each node m adjacent to n, reduce the in-degree of m and update its priority P(m). If the in-degree of m becomes 0, add it to Q and keep Q sorted in descending order by P(v). Finally, check whether there is a ring. If the number of nodes in L is less than the total number of nodes in the graph, report that there is a ring in the graph. Return the topological sorting result L. By considering node importance and edge weights, this improved Kahn algorithm can better reflect the actual order and importance of APT attacks and improve the accuracy of attack chain reconstruction.

[0154] b) Apply the beam search algorithm to generate kill chains: use a search width k = 5 and a maximum depth of 20. At each step, keep the k partial sequences with the highest scores.

[0155] c) Calculate the kill chain confidence using the conditional random field (CRF) model: For a kill chain C = {v1, v2, ..., v n}, define confidence: Conf(C) = Π i P(v i |v1,...,v i-1 ) uses the forward-backward algorithm to calculate the conditional probability.

[0156] 5. Future attack path prediction step: Based on the reconstructed kill chain sequence, this step predicts the future attack path:

[0157] a) Using the LSTM encoder with attention mechanism to generate state representation: s t =LSTM att (E)

[0158] Where E = {e1, e2, ..., e t} is the observed event sequence.

[0159] b) Define the action space of hierarchical softmax:

[0160] P(a t )=P(type t )·P(target t |tyPe t )

[0161] Where type t is the attack type, target t as the target of attack.

[0162] c) Apply Monte Carlo Tree Search (MCTS) algorithm for path prediction:

[0163] Use the UCT (Upper Confidence Bound for Trees) algorithm for node selection:

[0164]

[0165] where Q(s,a) is the state-action value function, N(s) is the number of visits to state s, N(s,a) is the number of visits to a state-action pair, and c is the exploration constant (usually set to ).

[0166] Each simulation is performed for 1000 iterations, and the child node with the most visits is selected as the prediction result.

[0167] 6. Explainability analysis step, based on the predicted attack path, this step generates an explainability analysis report:

[0168] a) Local interpretability: SHAP (SHapley Additive ex Planations) values ​​are used to calculate feature importance. For each prediction decision, the top 5 most important features and their contribution values ​​are generated.

[0169] b) Global interpretability: A decision tree is constructed to approximate the behavior of the QISCA-GCN model. The CART algorithm is used with a maximum depth of 5 and a minimum number of leaf node samples of 10.

[0170] c) Visualization: Use the force-directed graph algorithm to display the causal graph structure, and the thickness of the edge represents the weight. Use a heat map to display the attention weight distribution.

[0171] 7. Model update and optimization step. According to the interpretability analysis report, this step performs model update and optimization:

[0172] a) Incremental learning: Use a sliding window strategy, keep the data for the last 30 days each time, update the model every 24 hours, use the Adam optimizer, and the learning rate is 0.001.

[0173] b) Causal structure update: Re-evaluate the causal graph structure every week, using the improved PC algorithm. Introduce the Ll regularization term to encourage sparse structure: L = L origina1 +λ·||W||1, where λ is the regularization coefficient, usually set to 0.01.

[0174] c) Hyperparameter optimization: Use Bayesian optimization algorithm to automatically adjust hyperparameters. Optimization goal: maximize the weighted sum of F1 score and minimize false alarm rate. Use Gaussian process as surrogate model and expected improvement (EI) as acquisition function.

[0175] d) Model compression: Use knowledge distillation technology to transfer the knowledge of the large model (teacher model) to the small model (student model). The teacher model is the complete QISCA-GCN, and the student model is the lightweight GCN. The distillation temperature is usually set between 2-4.

[0176] Through the above steps, the method of the present invention can effectively reconstruct the APT kill chain and accurately predict possible future attack paths. For example, in actual application at a financial institution, the method successfully detected and prevented a highly complex APT attack involving multiple stages, including initial intrusion, lateral movement, and data theft. The system not only accurately reconstructs the kill chain, but also predicts the attacker's possible next move, allowing the security team to take defensive measures in advance.

[0177] Please refer to Figure 3,The APT kill chain reconstruction and prediction system of the present ,invention is composed of seven core modules, which are tightly integrated at the ,software level and supported by high-performance hardware.

[0178] The data preprocessing and causal graph construction module 1 uses Apache Spark for distributed data processing and Neo4j graph database to store causal graphs; utilizes the multi-core parallel processing capability of Intel Xeon CPU; and is used to extract multimodal features based on the output of the data preprocessing and causal graph construction module;

[0179] The multimodal feature extraction module 2 uses the PyTorch framework to implement the BERT, SDAE and LSTM models; the NVIDIA A100 GPU is used to accelerate deep learning model training and reasoning; and is used to perform multimodal feature extraction based on the output of the data preprocessing and causal graph construction modules.

[0180] The temporal causal graph convolution learning module 3 uses a custom PyTorch geometry library to implement the QISCA-GCN algorithm, which mainly relies on the GPU for large-scale matrix operations to apply the temporal causal graph convolution learning algorithm to the output of the multimodal feature extraction module.

[0181] The kill chain reconstruction module 4 uses the NetworkX library to implement the graph algorithm and scikit-leam to implement the CRF model. It mainly relies on the CPU for graph traversal and probability calculation, and is used to perform kill chain reconstruction based on the output of the temporal causal graph convolution learning module.

[0182] The future attack path prediction module 5 uses TensorFlow to implement the LSTM encoder and a custom Python library to implement the MCTS algorithm. The GPU is used for LSTM calculation and the CPU is used for MCTS search to predict the future attack path based on the output of the kill chain reconstruction module.

[0183] The interpretability analysis module 6 uses the SHAP library to calculate feature importance and the Graphviz library for visualization. It mainly relies on the CPU for analysis and rendering, and is used to generate interpretability analysis based on the output of the future attack path prediction module.

[0184] The model update and optimization module 7 uses the Ray library for distributed hyperparameter optimization and PyTorch for knowledge distillation. Distributed computing makes full use of multi-core CPU and multi-GPU resources to perform model update and optimization according to the output of the interpretability analysis module, and feeds back the optimization results to the data preprocessing and causal graph construction module.

[0185] The system workflow is as follows:

[0186] 1. Data is input into the system through a high-speed network interface and stored in a distributed file system after preprocessing.

[0187] 2. The feature extraction and graph learning processes are executed in parallel on the GPU cluster.

[0188] 3. Kill chain reconstruction and path prediction are performed in a CPU-GPU hybrid environment.

[0189] 4. The analysis results are transmitted to the display terminal of the security operation center via a high-bandwidth network.

[0190] 5. The model update process continues in the background, utilizing idle computing resources.

[0191] In order to verify the superiority of the present invention, we conducted a series of comparative experiments. The following is a detailed comparison of Example 1 of the present invention and three comparative examples:

[0192] Example 1: Complete implementation of the present invention

[0193] Comparative Example 1: Traditional rule-based APT detection system

[0194] Comparative Example 2: APT Detection System Using Ordinary GCN

[0195] Comparative Example 3: APT Detection System Using LSTM

[0196] Test environment: The real network environment of a large financial institution, including 10,000 nodes, with an observation period of 3 months.

[0197] Test indicators:

[0198] 1. Attack Detection Accuracy (ACC): Number of correctly identified attack events / total number of events

[0199] 2. Kill Chain Reconstruction Completeness (CR): Number of correctly reconstructed attack steps / total number of actual attack steps

[0200] 3. Future attack prediction accuracy (PAC): number of correctly predicted future attack steps / total number of predicted steps

[0201] 4. Average response time (ART): The average time (minutes) from the start of the attack to the system sending out an alert

[0202] 5. False alarm rate (FPR): number of false alarm attack events / total number of alarm events

[0203] Detection method:

[0204] ACC and FPR: Attack incidents reported through the manual review system

[0205] CR: Comparison with the kill chain manually analyzed by security experts

[0206] PAC: Record system predictions and verify them during subsequent observation periods

[0207] ART: Record timestamps in system logs

[0208] The test results are shown in the following table:

[0209] index Example 1 Comparative Example 1 Comparative Example 2 Comparative Example 3 ACC 95.8％ 78.3％ 86.5％ 84.2％ CR 92.7％ 61.4％ 79.1％ 73.6％ PAC 88.5％ not applicable 72.3％ 76.8％ ART 12.3 47.6 25.8 31.2 FPR 3.2％ 15.7％ 8.9％ 10.3％

[0210] It can be seen from the test results in the table that Example 1 demonstrates the significant advantages of the present invention:

[0211] 1. The attack detection accuracy (95.8%) is much higher than other methods, thanks to the effective integration of multimodal data and full utilization of spatiotemporal features by the QISCA-GCN algorithm.

[0212] 2. The high score of kill chain reconstruction completeness (92.7%) shows that the present invention is able to capture all stages of the attack more comprehensively, thanks to the combination of causal reasoning and graph structure learning.

[0213] 3. The accuracy of future attack prediction (88.5%) shows the powerful ability of this system in predictive defense, which is not available in traditional methods.

[0214] 4. The average response time (12.3 minutes) is significantly ahead of other methods, reflecting the real-time advantage of this system, which is crucial for preventing APT attacks in a timely manner.

[0215] 5. The low false positive rate (3.2%) shows that the system can effectively distinguish between normal activities and malicious behaviors, reducing the workload of the security team.

[0216] The above test results are analyzed as follows:

[0217] 1. Compared with Comparative Example 1 (traditional rule system), the present invention has significant improvements in all indicators, especially in kill chain reconstruction and response time. This shows that the machine learning-based method has obvious advantages in dealing with complex and dynamic APT attacks.

[0218] 2. Compared with Comparative Example 2 (ordinary GCN system), the accuracy and completeness of the present invention are improved by about 10%, which proves the superiority of the QISCA-GCN algorithm in processing time series data and capturing long-term dependencies.

[0219] 3. Comparative Example 3 (LSTM system) performs well in prediction accuracy, but is obviously inferior to the present invention in kill chain reconstruction. This shows that pure sequence models are difficult to capture the complex spatial relationships in network attacks.

[0220] 4. The significant reduction in false alarm rate of the present invention (reduced by more than 50% compared to other methods) shows that the integration of causal reasoning and deep learning can effectively reduce false alarms and improve the practicality of the system.

[0221] These test results fully demonstrate the comprehensive advantages of the present invention in APT attack detection, reconstruction and prediction. In particular, the system demonstrates excellent performance when dealing with complex and long kill chains. The low false alarm rate and fast response time make the system very suitable for deployment in large-scale, high-value network environments. The addition of future attack prediction capabilities provides strong support for active defense strategies. These advantages stem from the unique QISCA-GCN algorithm, multimodal data fusion method and causal reasoning of the present invention, which has brought revolutionary progress to the field of APT defense.

[0222] Through the above detailed description, the method and system of the present invention have demonstrated significant innovation and practical value in the field of APT attack detection and prevention, and provide a powerful tool for enterprise-level network security defense.

[0223] It should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A causal reasoning-based APT kill chain reconstruction and prediction method, characterized in that: The following steps are involved: Acquire multi-source heterogeneous data, and perform data preprocessing and causal graph construction based on the multi-source heterogeneous data to obtain an initial causal graph; Performing multimodal feature extraction based on the initial causal graph to obtain initial feature representation of nodes; Inputting the initial feature representation of the node into a temporal causal graph convolutional learning algorithm to obtain an optimized node representation; Performing kill chain reconstruction based on the optimized node representation to obtain a possible kill chain sequence; Predicting future attack paths based on the possible kill chain sequence to obtain potential attack paths; Generating an explainability analysis report based on the potential attack paths; And according to the explainability analysis report, the model is updated and optimized to optimize the initial causal graph, and the data preprocessing and causal graph construction steps are returned to form a closed-loop iteration.

2. According to claim 1, a method for reconstructing and predicting an APT kill chain based on causal reasoning is characterized in that: The temporal causal graph convolution learning algorithm is a quantum-inspired spatiotemporal causal attention graph convolution network, which includes the following steps: (a) Initialize the node quantum state vector |ψ i > (b) Perform T iterations: (b1) Based on the node quantum state vector |ψ i > Calculate quantum measurements to get node characteristics h I ; (b2) According to the node feature h i Update edge weight w ij ; (b3) Based on the edge weight W ij Compute multi-scale attention ij ; (b4) Using the multi-scale attention ij Update node representation h′ i ; (b5) Based on the updated node representation h′ i Update quantum state |ψ i > (c) Output the final node representation h I ; Among them, |ψ i > represents node v i The quantum state of h i Represents node v i The feature representation of w ij Represents node v i and v j The edge weight between ij Represents node v i v j The attention weight is , and T represents the number of iterations.

3. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 2 is characterized in that: The quantum measurement process in step (b1) is as follows: where ψ i represents the quantum state vector of node v i , p ik represents the probability distribution of node v i on the k-th mode, M = ∑ k λ k |k><k| is the quantum measurement operator, λ k is a learnable parameter, p ij is the probability distribution of node v i on the j-th mode, <j|k> is the inner product, and is obtained as follows: <j|k>=softmax(q T ·tanh(W·[x ij ||x ik ]+b)) Where W represents the weight matrix, q T represents a vector, where q is a set of learnable parameters, b represents the bias term, and x ij and x ik The nodes v i The features of the j-th and k-th modes, tanh(*) is the hyperbolic tangent function used for nonlinear transformation, || represents the concatenation operation, which concatenates two feature vectors into a longer feature vector.

4. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 2 is characterized in that: The edge weight updating process in step (b2) is as follows: w ij =g ij ·w ij +(1-g ij )·F(w ij ) Among them, g ij is the update gate, σ is the sigmoid function, W g represents the weight matrix, b g represents the bias term, Δt ij is the time interval, Δs ij is the spatial distance, D is the learnable fractal dimension, F(x) is the chaotic mapping function, defined as F(x) = rx(1-x), r is the learnable parameter, Represents node v i and node v j The D-dimensional fractal dimension of the time interval between them.

5. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 2 is characterized in that: The multi-scale attention calculation process in step (b3) is as follows: a ij =softmax(∑ l a l ·K l (i, j)) Among them, K l (i, j) is the multi-scale causal kernel, σ l is the kernel width of the lth scale, m ij is a mask based on causal structure, α l is the learnable scale weight, h i Represents node v i The characteristic representation of h j Represents node v j The feature representation of ||*|| 2 Represents the Euclidean norm of a vector.

6. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 2 is characterized in that: The node representation update process in step (b4) is as follows: Among them, W represents the weight matrix, b represents the bias term, and a ij Represents node v i For node v j The attention weight, R(x) is the residual function, defined as: R(x)=Q r ·x+b r W r represents the weight matrix, b r Denotes the bias term.

7. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 1 is characterized in that: The kill chain reconstruction steps include: Using an improved Kalm algorithm to topologically sort the optimized node representations to obtain a preliminary attack sequence; Applying a beam search algorithm based on the preliminary attack sequence to obtain multiple candidate kill chains; The multiple candidate kill chains are evaluated using a conditional random field model to obtain a final kill chain and its confidence level.

8. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 1 is characterized in that: The future attack path prediction step includes: Based on the possible kill chain sequence, the state representation is generated using the LSTM encoder with attention mechanism; Based on the state representation, define a hierarchical softmax action space; Based on the action space, a Monte Carlo tree search algorithm is applied to perform path prediction to obtain potential attack paths.

9. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 1 is characterized in that: The model updating and optimization steps include: Perform incremental learning based on the sliding window strategy to update model parameters; Update the causal structure using the improved PC algorithm; Apply Bayesian optimization algorithm for hyperparameter optimization; Model compression is performed through knowledge distillation technology to obtain an optimized lightweight model.

10. An APT kill chain reconstruction and prediction system based on causal reasoning, characterized in that: include: Data preprocessing and causal graph construction module, used to obtain multi-source heterogeneous data and perform data preprocessing and causal graph construction; A multimodal feature extraction module, used for performing multimodal feature extraction based on the output of the data preprocessing and causal graph construction module; A temporal causal graph convolutional learning module, used for applying a temporal causal graph convolutional learning algorithm to the output of the multimodal feature extraction module; A kill chain reconstruction module, configured to perform kill chain reconstruction based on the output of the temporal causal graph convolutional learning module; A future attack path prediction module, used to predict the future attack path according to the output of the kill chain reconstruction module; An explainability analysis module, configured to generate an explainability analysis based on the output of the future attack path prediction module; as well as The model updating and optimization module is used to perform model updating and optimization according to the output of the interpretability analysis module, and feed back the optimization result to the data preprocessing and causal graph construction module.

Images